[Discuss] With AI, 2, 000 Vulnerabilities per Linux kernel release

[kentborg at borg.org (Kent Borg)]

An interesting thing about the flood of new vulnerabilities is 
:crickets:.? There does not seem to be a flood of new attacks.

I think it is because computer systems are so poorly cobbled together, 
with so many vulnerabilities, that discovering a few more 
vulnerabilities doesn't much matter, having a vulnerability isn't the 
blocking item for cyber attackers.

It seems that a bigger problem is that setting up and running a criminal 
enterprise, or setting up and running a spy agency, is real work. 
Finding a vulnerability isn't the hard part.

Also, only some targets can be squeezed for lots of money or valuable 
intelligence, and there is little point in attacking the others.

Yes, *some* targets are hard (ios being the prime example), but even a 
new vulnerability there isn't worth much unless it can be chained 
together with other vulnerabilities to make a working exploit.


Most systems are Swiss cheese, and a fancy new tool for finding a news 
hole isn't the big deal we expected.


kb